CVE-2026-7199
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=delete_product. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
Risk Assessment
An attacker can read, modify, or delete data in the database, leading to data leakage or system corruption.
Recommendation
Apply the vendor's patch immediately or disable access to the /ajax.php?action=delete_product file. In the meantime, implement input filtering.
Other vulnerabilities in Pharmacy Sales and Inventory System
See all- CVE-2026-10255Medium
Pharmacy Sales and Inventory System 1.0 has a vulnerability in the sell_statement function of application/controllers/ShowForm.php, leading to improper access controls.
- CVE-2026-10248Medium
A CSV injection vulnerability was found in Pharmacy Sales and Inventory System up to version 1.0. The issue occurs in the supplier creation interface where the Address/Company Name arguments are improperly handled. Remote exploitation is possible and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=delete_product. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.